CVE-2026-64567

The CVE-2026-64567 vulnerability affects the Linux kernel’s btrfs free-space-cache loading. The issue stems from loading a v1 free-space cache where num_entries can exceed the available pages, allowing io_ctl_check_crc to advance past the end of the pages[] array. This leads to a slab-out-of-boun...

CVE-2026-71209

Audiobookshelf CVE-2026-71209 describes an authentication-exemption bypass in server/routers/Auth.js. The regex checks unauthenticated GET routes against req.path, but because req.path can contain URL-encoded %2F sequences, an encoded directory traversal like ..%2f..%2f..%2ftmp%2fpwned escapes th...

EUVD-2026-53206

audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route...

CVE-2026-66257 Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...

Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

MAL-2026-12049 Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

Linux Distros Unpatched Vulnerability : CVE-2026-64581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads...

Linux Distros Unpatched Vulnerability : CVE-2026-64567

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, loadfreespacecache takes numentries and numbitmaps straight fro...

SUSE SLES15 Security Update : bind (SUSE-SU-2026:3476-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3476-1 advisory. This update for bind fixes the following issues - CVE-2026-10723: Incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-1133...

SUSE SLES12: bind / bind-chrootenv / bind-devel / bind-doc / bind-utils / etc (SUSE-SU-2026:3484-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3484-1 advisory. This update for bind fixes the following issues - CVE-2026-11622: Potential memory usage beyond configured limits bsc1271986. - CVE-2026-11721:...

Malicious code in tinkoff-terminal-kit-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d67091b6d7ee752850793817e0bf77d92b3bc16bff12d5348e81c1cb39cf6423 On require of the package, index.js loads adapter.js, which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of thr...

CVE-2026-15337

A flaw was found in Django. A remote attacker could trigger a denial-of-service DoS condition by sending many distinct, very long language codes to the django.utils.translation.checkforlanguage function. These codes are stored in an in-memory cache, leading to excessive memory consumption. While...

CVE-2026-14643

A flaw was found in undici. The cache interceptor in undici improperly handles optional whitespace around the equals sign in no-cache or private Cache-Control directives. This vulnerability allows an attacker to bypass cache restrictions, leading to cross-user information disclosure. Specifically...

CVE-2026-24255

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

CVE-2026-13697

A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...

CVE-2026-24255

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

CVE-2026-24255

NVIDIA Dynamo for Linux is affected by CVE-2026-24255 in the multimodal embedding cache. The issue arises when submitting images that share an identical pixel byte sequence but have different dimensions, potentially enabling data tampering via a hash collision. Affected product: NVIDIA Dynamo for...

EUVD-2026-52803

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vulnerability might lead to data tamperin...

UBUNTU-CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...